Proactive Threat Intelligence and Detection Model Using Cloud-Native Security Tools

Computer and network technology is developing rapidly, meanwhile various cyber security incidents have occurred frequently. New vulnerabilities and many new security risks have emerged endlessly, which have caused serious threats to cyber security and business security. So the role and value of threat intelligence are increasing. However, there are still some problems of threat intelligence. The threat intelligence information can be tampered in the existing sharing mechanism. At the same time, there is no corresponding feedback mechanism for the quality of the threat intelligence information provided by the intelligence providers. There is a lack of credible judgment and corresponding incentive mechanism for threat intelligence providers. So, in order to solve these problems, a blockchain-based threat intelligence sharing and rating technology is proposed in this paper. Based on the characteristics of blockchain such as openness, consensus, autonomy and decentralization, trustlessness, non-tampering and traceability, the paper uses blockchain technology to build blocks of threat intelligence information, including IP address information, domain name information, URLs Information, security incident information, vulnerability information, threat intelligence source, user's evaluation, credibility of threat intelligence, contribution rate of threat intelligence, credibility of threat intelligence sources and contribution rate of threat intelligence sources. A threat intelligence sharing and rating system based on blockchain is designed in the paper, and the corresponding threat intelligence sharing method and rating method based on blockchain are given. It also proposes the smart contract for the threat intelligence sharing and rating in the paper. It can acquire and analyze the latest and most valuable threat intelligence information timely and effectively, so as to perform protection and emergency response timely, and promote the continuous and effective development of the closed loop of the entire threat intelligence ecosystem. The experimental environment and smart contract are designed, and its effectiveness is proved.

As security incidents might have disastrous consequences on an enterprise's information technology (IT), organizations need to secure their IT against threats. Threat intelligence (TI) promises to provide actionable information about current threats for information security management systems (ISMS). Common information range from malware characteristics to observed perpetrator origins that allow customizing security controls. The aim of this article is to assess the impact of utilizing public available threat feeds within the corporate process on an organization's security information level. We developed a framework to integrate TI for large corporations and evaluated said framework in cooperation with a global acting manufacturer and retailer. During the development of the TI framework, a specific provider of TI was analyzed and chosen for integration within the process of vulnerability management. The evaluation of this exemplary integration was assessed by members of the information security department at the cooperating enterprise. During our evaluation it was emphasized that a prioritization of management activities based on whether threats that have been observed in the wild are targeting them or similar companies. Furthermore, indicators of compromise (IoC) provided by the chosen TI source, can be automatically integrated utilizing a provided software development kit. Theoretical relevance is based on the contribution towards the verification of proposed benefits of TI integration, such as increasing the resilience of an enterprise network, within a real-world environment. Overall, practitioners suggest that TI integration should result in enhanced management of security budgets and more resilient enterprise networks.

OSTIS: A novel Organization-Specific Threat Intelligence System

Today’s threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a single unified taxonomy , removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time.

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

As artificial intelligence reshapes the cybersecurity landscape, the demand for a trustworthy, real-time intelligence platform to track security incidents has become mission-critical. This paper proposes AGS-INTEL, an AI-driven platform designed to revolutionize data breach intelligence by providing a credible, real-time repository that consolidates, verifies, and contextualizes global security incidents. Unlike traditional databases, AGS-INTEL employs a validated scoring algorithm and enriched metadata to capture breach dimensions (legal, technical, sectoral, geopolitical), drawing from GDPR/HIPAA disclosures, threat intelligence, dark web forums, and academic reports, among other sources. Utilizing NLP and agentic AI, it extracts structured metadata from unstructured narratives while integrating ethical data scraping, regulatory compliance, and cross-jurisdictional filtering to ensure high fidelity. A visual analytics dashboard empowers stakeholders, including regulators, policymakers, cybersecurity professionals, and journalists, to analyze breach trends by industry, geography, and threat modality, enhancing transparency and risk governance. By delivering authenticated, actionable data, AGS-INTEL addresses critical gaps in existing tools, setting a new standard for ethical AI in breach intelligence and strengthening societal resilience against escalating cyber threats.

APT-scope: A novel framework to predict advanced persistent threat groups from enriched heterogeneous information network of cyber threat intelligence

The automation and connectivity of CAV inherit most of the cyber-physical vulnerabilities of incumbent technologies such as evolving network architectures, wireless communications, and AIbased automation.This book chapter entails the cyber-physical vulnerabilities and risks that originated in IT, OT, and the physical domains of the CAV ecosystem, eclectic threat landscapes, and threat intelligence.To deal with the security threats in high-speed, high dimensional, multimodal data and assets from eccentric stakeholders of the CAV ecosystem, this chapter presents and analyzes some of the state of art deep learning-based threat intelligence for attack detection.The frontiers in deep learning-namely Meta-Learning and Federated Learning--along with their challenges have been included in the chapter.We have proposed, trained, and tested the deep CNN-LSTM architecture for CAV threat intelligence; assessed and compared the performance of the proposed model against other deep learning algorithms such as DNN, CNN, LSTM.Our results indicate the superiority of the proposed model although DNN and 1d-CNN also achieved more than 99% of accuracy, precision, recall, f1-score, and AUC on the CAV-KDD dataset.The good performance of deep CNN-LSTM comes with the increased model complexity and cumbersome hyperparameters tuning.Still, there are open challenges on deep learning adoption in the CAV cybersecurity paradigm due to lack of properly developed protocols and policies, poorly defined privileges between stakeholders, costlier training, adversarial threats to the model, and poor generalizability of the model under out of data distributions.Contents 6.1.1.Dataset 13 6.1.2.Evaluation metrics 15 6.2.RESULTS AND DISCUSSIONS 16 7.CONCLUSION 18 References

Many organizations are continually put in danger by sophisticated and malevolent cyber attacks in today's rapidly developing threat landscape, which is evolving at a rapid rate. Cybercriminals, who are more skilled, more organized, and have more financial resources than in the past. Cyber Threat Intelligence, abbreviated as CTI, has emerged as a popular topic and is now being considered by many organizations as a potential solution to the growing number of cyber attacks. The purpose of this work is to conduct a literature review on the previous research that has been done on CTI. The most fundamental question about what CTI is investigated through the process of doing a literature study. This is done by contrasting several definitions in order to identify areas of agreement and disagreement. It has been discovered that neither the organization nor the suppliers have a comprehensive grasp of the information that is deemed to be CTI; hence, further study is required in order to define CTI. This article also listed existing CTI products and services, including as threat intelligence data feeds, threat intelligence standards, and tools that are being utilized in CTI. This study outlines four research issues in cyber threat intelligence and assesses contemporary work carried out in each of those areas. These difficulties were determined based on an assessment of the CTI definition, standards, and technologies. When an organization is inundated with a massive amount of threat data, the need for trained threat data analysts who are able to fully utilize CTI and transform the data into actionable information becomes more vital than it has ever been before. The problem of poor data quality is not a recent development; nonetheless, because to the increasing use of CTI, further study in this field is required.

The increasing sophistication of cyber threats originating from the Dark Web has necessitated the development of advanced threat intelligence frameworks capable of detecting and predicting malicious activities in real time. Traditional cybersecurity approaches often struggle to process the vast, unstructured, and linguistically diverse data generated on underground forums and illicit marketplaces. Transformer-based natural language processing (NLP) models, such as Bidirectional Encoder Representations from Transformers (BERT) and Generative Pre-trained Transformers (GPT), have demonstrated exceptional capabilities in understanding and generating contextualized textual representations, making them highly effective for Dark Web analysis and cybercrime prediction. This chapter explores the integration of transformer-based models in cyber threat intelligence workflows, emphasizing their ability to automate the identification of emerging threats, detect cybercriminal activities, and forecast evolving attack patterns. Key challenges, including data scarcity, adversarial linguistic variations, and ethical considerations in Dark Web monitoring, are analyzed alongside potential solutions leveraging AI-driven methodologies. , the chapter discusses the implications of transformer-based threat intelligence frameworks for real-time cybersecurity applications and future research directions aimed at enhancing cyber resilience. The insights presented contribute to the advancement of AI-driven cyber threat intelligence, enabling proactive threat mitigation strategies in an increasingly complex digital threat landscape.

In the evolving cyber threat landscape, comprehensive understanding and timely analysis of attack vectors are critical for effective defense. This paper introduces a novel approach to simulate, transform, and integrate synthetic honeypot logs into a graph database using the Structured Threat Information Expression (STIX) data model. Leveraging Neo4j’s graph capabilities, we convert voluminous, complex attack data into interconnected threat intelligence objects, facilitating the visualization and exploration of intricate attack graphs. By employing Python-driven automation for log generation and STIX transformation, challenges concerning data compatibility, nested property flattening, and cybersecurity compliance are addressed. The resultant graph-based threat intelligence framework provides a scalable and standardized platform empowering Security Operations Centers (SOCs) with enhanced situational awareness and decision-making support, paving the way for improved cybersecurity posture and collaborative defense strategies.

The rapid growth of digital infrastructure has intensified the scale and sophistication of cyber threats, demanding more adaptive and intelligent detection mechanisms. Natural language processing (NLP) has emerged as a critical enabler for cybersecurity threat detection by transforming unstructured textual data—such as threat intelligence reports, security logs, phishing messages, and malware descriptions—into actionable security insights. Recent advances in transformer-based architectures and large language models have significantly improved the automated identification of malicious patterns, threat actor behaviors, indicators of compromise, and tactics, techniques, and procedures embedded within heterogeneous cyber data sources. NLP-driven systems enable semantic understanding, contextual reasoning, and cross-document knowledge extraction, overcoming the limitations of rule-based and signature-driven approaches that struggle with zero- day and polymorphic attacks. By integrating named entity recognition, relation extraction, text classification, and knowledge graph construction, modern NLP frameworks support end-to-end threat intelligence pipelines that enhance situational awareness and accelerate incident response. Moreover, the convergence of NLP with cybersecurity facilitates scalable phishing detection, malware classification, and automated threat intelligence structuring, enabling interoperability with standardized security platforms. Despite these advances, challenges remain in model robustness, explainability, domain adaptation, and resistance to adversarial manipulation. This abstract highlights the role of NLP-driven approaches in advancing cybersecurity threat detection, emphasizing their capacity to automate intelligence extraction, improve detection accuracy, and support proactive defense strategies in an evolving threat landscape.

“Securing the Digital Frontier: Navigating Cyber Threats in Cloud, Network, and Information Security” offers a comprehensive exploration of the intricate landscape of Cyber security, meticulously designed to equip readers with a robust understanding of contemporary challenges and proactive strategies. With an elaborate Table of Contents spanning thirteen chapters, the book embarks on a journey that starts with laying the groundwork in Chapter 1, providing a holistic Introduction to Cyber security. Here, readers delve into the nuances of the digital realm, tracing the Evolution of Cyber Threats, and comprehending the Historical Milestones that have shaped the field. It underscores the paramount Importance of Cyber security in Modern Society and elucidates the Current State of Cyber security Challenges while speculating on Future Projections and Trends, emphasizing the Interdisciplinary Nature of Cyber security. Moving forward, Chapter 2 delves into the Fundamentals of Information Security, elucidating the CIA Triad – Confidentiality, Integrity, and Availability. It navigates through Risk Management, Compliance, and Regulatory Frameworks, shedding light on Security Policies and Procedures alongside the significance of Security Awareness Training and Incident Response Planning. Subsequent chapters systematically dissect various domains of Cyber security, from Network Security (Chapter 3) to Cloud Security (Chapter 4), Endpoint Security (Chapter 5), and Identity and Access Management (Chapter 6). Each chapter meticulously examines core concepts, methodologies, and best practices essential for fortifying digital infrastructures against evolving threats. The discourse extends to Data Protection (Chapter 7), Threat Intelligence and Detection (Chapter 8), and Incident Response and Management (Chapter 9), offering invaluable insights into encryption techniques, threat hunting strategies, and incident triage frameworks. Furthermore, Security Operations and Monitoring (Chapter 10) elucidates the pivotal role of Security Operations Centers (SOCs), Vulnerability Management, and Red Team vs. Blue Team Exercises in bolstering cyber defenses. Chapter 11 ventures into Emerging Technologies and Threats, contemplating the security ramifications of IoT, AI, Quantum Computing, Block chain, AR, VR, and Biometric Authentication. Meanwhile, Chapter 12 explores the realm of Ethical Hacking and Penetration Testing, unraveling methodologies for ethical hacking, vulnerability assessment, and social engineering mitigation. Finally, Chapter 13 prognosticates on Future Trends and Challenges, accentuating the imperative of addressing the Skills Gap, fostering Global Collaboration, and navigating Regulatory Challenges amidst burgeoning technological advancements. It underscores the ethical considerations paramount in Cyber security endeavors while advocating for resilience-building strategies against escalating cyber threats. In essence, “Securing the Digital Frontier” transcends the realms of a conventional Cyber security manual, emerging as an indispensable compendium for Cyber security professionals, aspiring enthusiasts, and stakeholders navigating the ever-evolving digital ecosystem. It amalgamates theoretical insights with practical wisdom, empowering readers to navigate the complex terrain of cyber threats with confidence and acumen.

RDP-based Lateral Movement detection using Machine Learning

Cloud record facilities provide flexible and scalable surroundings for executing loads of workloads. However, efficient useful resource allocation is crucial for the effective transport of cloud offerings, making sure they're fee-efficient and keep Quality of Service (QoS). Multi-Objective Scheduling Algorithms (MOSAs) have emerged as a promising solution to balance performance, value, and QoS metrics in cloud environments. This study investigates the effectiveness of numerous MOSAs for optimizing useful resource allocation in cloud workloads. We behavior a comparative has a look at of several algorithms, assessing their overall performance, fee implications, and QoS metrics across various cloud situations. Our method includes a quantitative analysis of execution time and fee, along with a qualitative assessment of QoS attributes inclusive of availability, reliability, and response time. Additionally, we discover how wonderful workload traits along with batch processing, real-time processing, and fact-intensive analytics impact the performance of those algorithms. The findings will provide valuable insights into the strengths and weaknesses of various scheduling algorithms and inform the future layout of greater effective cloud scheduling structures